March 2016 - Freeradius-Users - lists.freeradius.org

Modify Accounting records
by Andrés Gómez 29 Mar '16

29 Mar '16

Hi dear list. I have a trouble. I'm using a NAS that sends its accounting data fine, but it send its MAC address in the calledstationid data, but it use a " - " as separator instead of ":" like my other NAS. Is there a way to change that " - " character by the " : " when it arrives? May be using ulang? Regards -- *C. Andrés Gómez R.*

4 7

Freeradius vs bash control
by Syed Jahanzaib 28 Mar '16

28 Mar '16

Greetings. I need some recommendation. Is it good idea to control users disconnection / coa via freeradius (via accounting section ) ? Or its better to do via bash script which pulls data from the mysql and take action accordingly like disconnect expired / over quota users or change package accordingly or aimilar actions?

3 2

Support for EAP-AKA in free radius
by manjunath uthappa ponnachana 27 Mar '16

27 Mar '16

Hi, Wanted to know whether free radius support EAP-AKA.Heard there is some patch available for EAP-AKA in free radius.Please let me know  the link/source from where this patch can be downloaded.It will be helpful, if somebody can send the steps for configuring free radius with EAP-AKA. Thanks & regardsManjunath

4 3

Support for EAP-AKA in free radius
by manjunath uthappa ponnachana 27 Mar '16

27 Mar '16

Hi, Wanted to know whether free radius support EAP-AKA.Heard there is some patch available for EAP-AKA in free radius.Please let me know  the link/source from where this patch can be downloaded.It will be helpful, if somebody can send the steps for configuring free radius with EAP-AKA. Thanks & regardsManjunath

1 0

FR V3 returns no attribute Cisco-AVPAir, Framed-IP-Adress
by Stephane Branchoux 26 Mar '16

26 Mar '16

Hello, I would like to upgrade my FR V2 to V3. I installed a new FR V3 and just modified /etc/raddb/sites-available/default file to test ldap connectivity I read docs, man pages, wiki ... # diff /etc/raddb/sites-available/default /etc/raddb/sites-available/default.orig 382,389c382 < #-ldap < ldap < if ((ok || updated) && User-Password) { < update { < control:Auth-Type := ldap < } < } < --- > -ldap 495,497c488,490 < Auth-Type LDAP { < ldap < } --- > # Auth-Type LDAP { > # ldap > # } 671c664 < #cui --- > # cui 677c670 < reply_log --- > # reply_log 695c688 < ldap --- > # ldap diff /etc/raddb/mods-available/ldap.orig /etc/raddb/mods-available/ldap 12c12,13 < server = "ldap.rrdns.example.org ldap.rrdns.example.org ldap.example.org" --- > # server = "ldap.rrdns.example.org ldap.rrdns.example.org ldap.example.org" > server = "ldapmaster.univ-perp.fr ldapmaster1.univ-perp.fr" 20a22,24 > # > identity = "cn=Manager,dc=univ-perp,dc=fr" > password = ZZZZZ 24a29 > base_dn = "dc=univ-perp,dc=fr" 74,78c79,83 < # control:NT-Password := 'ntPassword' < # reply:Reply-Message := 'radiusReplyMessage' < # reply:Tunnel-Type := 'radiusTunnelType' < # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' < # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' --- > control:NT-Password := 'ntPassword' > reply:Reply-Message := 'radiusReplyMessage' > reply:Tunnel-Type := 'radiusTunnelType' > reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' > reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' 84,85c89,90 < # control: += 'radiusCheckAttributes' < # reply: += 'radiusReplyAttributes' --- > #control: += 'radiusCheckAttributes' > #reply: += 'radiusReplyAttributes' 95c100 < # edir_autz = no --- > edir_autz = no 117c122,124 < filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" --- > #filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" > filter = "(|(uid=%{%{Stripped-User-Name}:-%{User-Name}}) (mail=%{%{Stripped-User-Name}:-%{User-Name}}))" > #filter = "(|(uid=%{Stripped-User-Name:-%{User-Name}}) (mail=%{Stripped-User-Name:-%{User-Name}}))" 125c132 < # access_attribute = "dialupAccess" --- > # access_attribute = "dialupAccess" 181c188,189 < membership_attribute = "memberOf" --- > #membership_attribute = "memberOf" > membership_attribute = "eduPersonPrimaryAffiliation" Authentication again LDAP in ok : radtest -x stephane xxxxxxxxx localhost 10 testing123 Sending Access-Request Id 157 from 0.0.0.0:41822 to 127.0.0.1:1812 User-Name = 'YYYYYYYY' User-Password = 'XXXXXXX' NAS-IP-Address = 194.167.137.68 NAS-Port = 10 Message-Authenticator = 0x00 Received Access-Accept Id 157 from 127.0.0.1:1812 to 127.0.0.1:41822 length 20 debug is : Received Access-Request Id 247 from 127.0.0.1:41643 to 127.0.0.1:1812 length 78 User-Name = 'stephane' User-Password = 'sssssssssssss' NAS-IP-Address = 194.167.137.xx NAS-Port = 10 Message-Authenticator = 0x32e138a8b8b22a81acf0e74bd6e8cd13 (0) Received Access-Request packet from host 127.0.0.1 port 41643, id=247, length=78 (0) User-Name = 'stephane' (0) User-Password = 'YYYYYYYYYYYY' (0) NAS-IP-Address = 194.167.137.xx (0) NAS-Port = 10 (0) Message-Authenticator = 0x32e138a8b8b22a81acf0e74bd6e8cd13 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "stephane", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (4) (0) ldap : EXPAND (|(uid=%{%{Stripped-User-Name}:-%{User-Name}}) (mail=%{%{Stripped-User-Name}:-%{User-Name}})) (0) ldap : --> (|(uid=stephane) (mail=stephane)) (0) ldap : EXPAND dc=univ-perp,dc=fr (0) ldap : --> dc=univ-perp,dc=fr (0) ldap : Performing search in 'dc=univ-perp,dc=fr' with filter '(|(uid=stephane) (mail=stephane))', scope 'sub' (0) ldap : Waiting for search result... (0) ldap : User object found at DN "uid=stephane,ou=people,dc=univ-perp,dc=fr" (0) ldap : Processing user attributes (0) ldap : control:Password-With-Header += '{SSHA}UUUUUUUUUJ' rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) if ((ok || updated) && User-Password) (0) if ((ok || updated) && User-Password) -> TRUE (0) if ((ok || updated) && User-Password) { (0) update { (0) control:Auth-Type := LDAP (0) } # update = noop (0) } # if ((ok || updated) && User-Password) = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap : Normalizing SSHA1-Password from base64 encoding, 32 bytes -> 24 bytes (0) WARNING: pap : Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type LDAP { (0) ldap : Login attempt by "stephane" rlm_ldap (ldap): Reserved connection (4) (0) ldap : Using user DN from request "uid=stephane,ou=people,dc=univ-perp,dc=fr" (0) ldap : Waiting for bind result... (0) ldap : Bind successful (0) ldap : Bind as user "uid=stephane,ou=people,dc=univ-perp,dc=fr" was successful rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) reply_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log : --> /var/log/radius/radacct/127.0.0.1/reply-detail-20160323 (0) reply_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/reply-detail-20160323 (0) reply_log : EXPAND %t (0) reply_log : --> Wed Mar 23 14:48:32 2016 (0) [reply_log] = ok (0) ldap : EXPAND . (0) ldap : --> . (0) ldap : EXPAND Authenticated at %S (0) ldap : --> Authenticated at 2016-03-23 14:48:32 rlm_ldap (ldap): Reserved connection (4) (0) ldap : Using user DN from request "uid=stephane,ou=people,dc=univ-perp,dc=fr" (0) ldap : Waiting for bind result... (0) ldap : Bind successful (0) ldap : Modifying object with DN "uid=stephane,ou=people,dc=univ-perp,dc=fr" (0) ldap : Waiting for modify result... rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) [exec] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sending Access-Accept packet to host 127.0.0.1 port 41643, id=247, length=0 Sending Access-Accept Id 247 from 127.0.0.1:1812 to 127.0.0.1:41643 (0) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. The problem is that FR returns access-accept but no ldap attributes Cisco-AVPAir, Framed-IP-Adress .... Where is my mistake ? Many thanks in advance The same radtest on my FR V2 returns : rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=172, length=86 Framed-IP-Address = 10.100.0.254 Cisco-AVPair = "shell:priv-lvl=15" Tunnel-Type:1 = VLAN Tunnel-Medium-Type:1 = IEEE-802 Tunnel-Private-Group-Id:1 = "5" Service-Type = Login-User Brocade-Auth-Role = "admin" -- stephane BRANCHOUX Centre de Ressources Informatiques de l'Université de Perpignan. Systèmes/Réseaux - RSSI mailto:stephane.branchoux@univ-perp.fr 04 68 66 21 24 / 07 60 73 38 42

3 3

Re: about simultaneous & wispr-bandwidth
by Anirudh Malhotra 26 Mar '16

26 Mar '16

Use both attributes in one group simultaneous use and bandwidth dont use two different groups. At once only one group will be used. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in On 27 Mar 2016, 00:35 +0530, Serkan Kasap<s.kasap(a)turquoise.com.tr>, wrote: > Hi, > > Today i saw a problem and need yours help. > > i am using simultaneous use option and wispr-bandwith up&down. > > İf i use two options for one user first attribute working second not > working. > > For example user name: cat simultaneuse : 1 bandwith up:500 bandwith > down:500 > > i need to use them together. İ thing i am making some mistakes. > > > > İf i use just simultaneous or bandwith it's working but with together not > working. > > > > > > Radusergroup table > > "username" "groupname" "priority" > > "cat" "speed_512" "1" > > "cat" "user_limit_1" "1" > > > > Radgroupreply table > > "id" "groupname" "attribute" "op" "value" > > "19" "speed_512" "WISPr-Bandwidth-Max-Up" "==" "504800" > > "20" "speed_512" "WISPr-Bandwidth-Max-Down" "==" > "504800" > > > > Radgroupcheck table > > "id" "groupname" "attribute" "op" "value" > > "3" " user_limit_1" "Simultaneous-Use" ":=" "1" > > > > > > > > Thanks. > > > > serkan > > > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

about simultaneous & wispr-bandwidth
by Serkan Kasap 26 Mar '16

26 Mar '16

Hi, Today i saw a problem and need yours help. i am using simultaneous use option and wispr-bandwith up&down. İf i use two options for one user first attribute working second not working. For example user name: cat simultaneuse : 1 bandwith up:500 bandwith down:500 i need to use them together. İ thing i am making some mistakes. İf i use just simultaneous or bandwith it's working but with together not working. Radusergroup table "username" "groupname" "priority" "cat" "speed_512" "1" "cat" "user_limit_1" "1" Radgroupreply table "id" "groupname" "attribute" "op" "value" "19" "speed_512" "WISPr-Bandwidth-Max-Up" "==" "504800" "20" "speed_512" "WISPr-Bandwidth-Max-Down" "==" "504800" Radgroupcheck table "id" "groupname" "attribute" "op" "value" "3" " user_limit_1" "Simultaneous-Use" ":=" "1" Thanks. serkan

1 0

Debian 8 prevents the NAS to generate data volume accounting
by oatech 26 Mar '16

26 Mar '16

Something strange is happening : While the Windows 10 client does have a valid accounting stop message generated, with proper data accounting values ( Acct-Input-Packets, Acct-Output-Packets, Acct-Input-Octets, Acct-Output-Octets), the Debian 8 client always have 0 in each of these fields. Ex : sudo cat /var/log/freeradius/radacct/192.168.1.2/detail-20160324 | grep Acct-Input-Octets Acct-Input-Octets = 43976 Acct-Input-Octets = 845 Acct-Input-Octets = 394240 Acct-Input-Octets = 0 Acct-Input-Octets = 371260 Acct-Input-Octets = 0 ( Here, Windows 10 gets proper values recorded, Debian 8 always gets 0 ) Does anybody understand what may cause Debian 8 to prevent data accounting ? I'm using a very standard Freeradius/MySQL setup ... Clients : Windows 10 / Debian 8 NAS : Cisco SB WAP121 RADIUS Server : Debian 8 / FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu, Authentication : PEAP/MSCHAPv2 --- L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast. https://www.avast.com/antivirus

3 4

FR with Mikrotik - FUP Quota Bandwidth not changing auto
by AACABLE / Mikrotik System 26 Mar '16

26 Mar '16

Greetings, I have FR 2.x with Mikrotik 6.x. I want that when user quota limit end, his bandwidth package should change from 1mb to 512k. I have made counter and its working as expected. The only issue is that the changes are not being done on the fly. Changes applies only when user disconnects, and re-login. Same thing happens for users whose monthly quota limit finish but they are keep connected and gets denied only on re-login. When I issue following command it works fine. (for the bandwidth COA and POD) echo User-Name := "zaib", Mikrotik-Rate-Limit = 512k/512k | radclient -x 101.11.11.255:1700 coa 12345 [Mikrotik accepts this command and change the bandwidth on the fly] echo user-name=zaib | radclient -x 101.11.11.255:1700 disconnect 12345 [Mikrotik accepts this command and disconnects the user as instructed] How can I do this on the fly using FR? I know its the job of NAS but NAS will act only when FR will tell him to do so. Kindly assist. *SQL *Counter: *=============* counter-name = Mikrotik-Total-Limit check-name = Mikrotik-Total-Limit reply-name = Mikrotik-Total-Limit sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctInputOctets)+SUM(AcctOutputOctets) FROM radacct WHERE UserName='%{%k}'" } *=============* *AUTHORIZE *Section: dailyquota { reject = 1 } if (reject) { ok update reply { Mikrotik-Rate-Limit := "512k/512k" Reply-Message := "You have reached your daily 300MB transfer limit. Enforcing 512k FUP Policy - zaib " } } *=============* -- Regard's JAY-Z

2 11

Freeradius/LDAP Authentication issue
by Benjamin Dupalut 25 Mar '16

25 Mar '16

Hi, First of all, sorry for my bad english. I have installed Freeradius (Version: 2.2.5+dfsg-0.2) on Debian 8.3 to authenticate users via our LDAP. I face an issue when i perform this radtest : /radtest toto "totopassword" 127.0.0.1 18120 "clientpassword"/ Here is the freeradius -X debug : rad_recv: Access-Request packet from host 127.0.0.1 port 44928, id=111, length=48 Sending duplicate reply to client localhost port 44928 - ID: 111 Sending Access-Reject of id 111 to 127.0.0.1 port 44928 Waking up in 2.9 seconds. Cleaning up request 2 ID 111 with timestamp +114 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 44928, id=111, length=48 User-Name = "toto" User-Password = "Ғ\325\354R\010\r\035\303b\230Fo8đ" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[mschap] = noop [suffix] No '@' in User-Name = "toto", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop ++group { [ldap_1] performing user authorization for toto [ldap_1] expand: %{Stripped-User-Name} -> [ldap_1] ... expanding second conditional [ldap_1] expand: %{User-Name} -> toto [ldap_1] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=toto) [ldap_1] expand: ou=Users,dc=XXXX,dc=fr -> ou=Users,dc=XXXX,dc=fr [ldap_1] ldap_get_conn: Checking Id: 0 [ldap_1] ldap_get_conn: Got Id: 0 [ldap_1] performing search in ou=Users,dc=XXXX,dc=fr, with filter (uid=toto) [ldap_1] checking if remote access for toto is allowed by uid [ldap_1] No default NMAS login sequence [ldap_1] looking for check items in directory... [ldap_1] sambaNtPassword -> NT-Password == 0x3344424445363937443731363930413736393230344245423132323833363738 [ldap_1] sambaLmPassword -> LM-Password == 0x4343463931353545334537444234353341414433423433354235313430344545 [ldap_1] userPassword -> Cleartext-Password == "{MD5}ICy5YqxZB1uWSwcVLSNLcA==" [ldap_1] userPassword -> Password-With-Header == "{MD5}ICy5YqxZB1uWSwcVLSNLcA==" [ldap_1] sambaNtPassword -> NT-Password == 0x3344424445363937443731363930413736393230344245423132323833363738 [ldap_1] sambaLmPassword -> LM-Password == 0x4343463931353545334537444234353341414433423433354235313430344545 [ldap_1] looking for reply items in directory... [ldap_1] user toto authorized to use remote access [ldap_1] ldap_release_conn: Release Id: 0 +++[ldap_1] = ok ++} # group = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = ok WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! } # server inner-tunnel Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> toto attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 111 to 127.0.0.1 port 44928 Waking up in 4.9 seconds. Cleaning up request 3 ID 111 with timestamp +120 Ready to process requests. The user and client passwords are correct and i don't understand the following errors : WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Thank you for your replies. Cordialement, - - Benjamin Dupalut Administrateur système et réseau Service des Moyens Informatiques Généraux (SMIG) ESIEE Paris 2 bd Blaise Pascal - 93162 Noisy-le-Grand Cedex T : +33 1 45 92 66 17 benjamin.dupalut(a)esiee.fr www.esiee.fr / www.cci-paris-idf.fr

7 17